AWSConfigRemediation-EnforceEC2InstanceIMDSv2
Description
The AWSConfigRemediation-EnforceEC2InstanceIMDSv2
runbook requires
the Amazon Elastic Compute Cloud (Amazon EC2) instance you specify to use Instance Metadata Service Version
2 (IMDSv2).
Document type
Automation
Owner
Amazon
Platforms
Linux, macOS, Windows
Parameters
-
InstanceId
Type: String
Description: (Required) The ID of the Amazon EC2 instance you want to require to use IMDSv2.
-
AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
Required IAM permissions
The AutomationAssumeRole
parameter requires the following actions to
use the runbook successfully.
-
ssm:StartAutomationExecution
-
ssm:GetAutomationExecution
-
ec2:DescribeInstances
-
ec2:ModifyInstanceMetadataOptions
Document Steps
-
aws:executeScript
- Sets theHttpTokens
option torequired
on the Amazon EC2 instance you specify in theInstanceId
parameter. -
aws:assertAwsResourceProperty
- Verifies IMDSv2 is required on the Amazon EC2 instance.